Augmenting functionality in distributed systems with payload headers

ABSTRACT

A method for data processing may include receiving a communication from a parent span, the communication including a data portion and a header portion. The header portion may include an identifier of an originating service that produced the communication, an identifier of a transaction for the communication, and an identifier of the parent span. The method may include identifying the parent span and the originating serviced based on the header portion. The method may also include performing a system trace process of the communication throughout the transaction based on the parent span and the originating service.

CROSS REFERENCE

The present Application for patent is a continuation of U.S. patentapplication Ser. No. 15/448,517 by Goyal, entitled “AUGMENTINGFUNCTIONALITY IN DISTRIBUTED SYSTEMS WITH PAYLOAD,” filed Mar. 2, 2017,and assigned to the assignee hereof.

FIELD OF TECHNOLOGY

The present disclosure relates generally to database systems andcommunication data processing, and more specifically to augmentingfunctionality in distributed systems with payload headers.

BACKGROUND

A cloud platform (i.e., a computing platform for cloud computing) may beemployed by many users to store, manage, and process data using a sharednetwork of remote servers. Users may develop applications on the cloudplatform to handle the storage, management, and processing of data. Insome cases, the cloud platform may utilize a multi-tenant databasesystem. Users may access the cloud platform using various user devices(e.g., desktop computers, laptops, smartphones, tablets, or othercomputing systems, etc.).

In one example, the cloud platform may support customer relationshipmanagement (CRM) solutions. This may include support for sales, service,marketing, community, analytics, applications, and the Internet ofThings. A user may utilize the cloud platform to help manage contacts ofthe user. For example, managing contacts of the user may includeanalyzing data, storing and preparing communications, and trackingopportunities and sales.

The cloud platform may be configured as a distributed system. Adistributed system may include multiple groups of machines performingvarious tasks in a coordinated fashion to process data flowing throughthe system. A distributed system may be configured to process largeamounts of data (e.g., over a hundred million events per day). Due tothe high volume of data and the large number of machines processing thedata, it may be difficult to perform a diagnostic analysis on thesystem.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an example of an environment for communication dataprocessing that supports augmenting functionality in distributed systemswith payload headers in accordance with aspects of the presentdisclosure.

FIG. 2 illustrates an example of a system for communication dataprocessing that supports augmenting functionality in distributed systemswith payload headers in accordance with aspects of the presentdisclosure.

FIG. 3 illustrates an example of a transaction that supports augmentingfunctionality in distributed systems with payload headers in accordancewith aspects of the present disclosure.

FIG. 4 shows a block diagram of a system that supports augmentingfunctionality in distributed systems with payload headers in accordancewith aspects of the present disclosure.

FIG. 5 shows a block diagram of a data header manager that supportsaugmenting functionality in distributed systems with payload headers inaccordance with aspects of the present disclosure.

FIG. 6 illustrates a block diagram of an environment including a dataheader manager that supports augmenting functionality in distributedsystems with payload headers in accordance with aspects of the presentdisclosure.

FIGS. 7 through 9 illustrate methods for augmenting functionality indistributed systems with payload headers in accordance with aspects ofthe present disclosure.

DETAILED DESCRIPTION

A distributed system may be used to process large amounts of data, andmay include many machines (e.g., hundreds of thousands) configured toperform various processes on a piece of data (e.g., an email) as thedata flows through the system. Diagnosing the performance of adistributed system may be difficult due to the complexity of the systemarchitecture, the number of individual machines and processes, the highvolume of data flowing through the system, or a combination of thesefactors. For example, if data is being lost within the system or istaking too long to propagate through the system, it may be difficult todetermine which machines or processes are causing the problem.

In accordance with aspects of the present disclosure, a distributedsystem may be configured to wrap data with one or more headers as thedata enters the system. These headers may be configured to providediagnostic information regarding the performance of the system, such astemporal relationships and causal relationships indicating when and howthe data propagates throughout the system (e.g., a tracing process). Theheaders may also be configured to facilitate real-time changes to thesystem to improve performance of the system (e.g., throttling). Theheaders may also provide security protocols for data to ensure theintegrity of the data as it flows through the system. Examples of thetypes of headers that may be used include a parent service identifierheader, a trace information header, header tags, a web token header, ora combination of these headers. The headers may facilitate thesediagnostic, performance, and security functions without modifying thepayload of the data. The headers may also be configured to add little orno additional processing load to the system.

Aspects of the disclosure are initially described in the context of anenvironment supporting distributed computing. An example of adistributed system configured to support augmenting functionality withpayload headers is then described. Aspects of the disclosure are furtherillustrated by and described with reference to apparatus diagrams,system diagrams, and flowcharts that relate to augmenting functionalityin distributed systems with payload headers.

FIG. 1 illustrates an example of an environment 100 for cloud computingthat supports augmenting functionality in distributed systems withpayload headers in accordance with various aspects of the presentdisclosure. The environment 100 includes cloud clients 105, contacts110, cloud platform 115, and data center 120. Cloud platform 115 may bean example of a public or private cloud network. A cloud client 105 mayaccess cloud platform 115 over network connection 135. The network mayimplement transfer control protocol and internet protocol (TCP/IP), suchas the Internet, or may implement other network protocols. A cloudclient 105 may be an example of a user device, such as a server (e.g.,cloud client 105-a), a smartphone (e.g., cloud client 105-b), or alaptop (e.g., cloud client 105-c). In other examples, a cloud client 105may be a desktop computer, a tablet, a sensor, or another computingdevice or system capable of generating, analyzing, transmitting, orreceiving communications. In some examples, a cloud client 105 may beoperated by a user that is part of a business, an enterprise, anon-profit, a startup, or any other organization type.

A cloud client 105 may interact with multiple contacts 110. Theinteractions 130 may include communications, opportunities, purchases,sales, or any other interaction between a cloud client 105 and a contact110. Data may be associated with the interactions 130. A cloud client105 may access cloud platform 115 to store, manage, and process the dataassociated with the interactions 130. In some cases, the cloud client105 may have an associated security or permission level. A cloud client105 may have access to certain applications, data, and databaseinformation within cloud platform 115 based on the associated securityor permission level, and may not have access to others.

Contacts 110 may interact with the cloud client 105 in person or viaphone, email, web, text messages, mail, or any other appropriate form ofinteraction (e.g., interactions 130-a, 130-b, 130-c, and 130-d). Theinteraction 130 may be a business-to-business (B2B) interaction or abusiness-to-consumer (B2C) interaction. A contact 110 may also bereferred to as a customer, a potential customer, a lead, a client, orsome other suitable terminology. In some cases, the contact 110 may bean example of a user device, such as a server (e.g., contact 110-a), alaptop (e.g., contact 110-b), a smartphone (e.g., contact 110-c), or asensor (e.g., contact 110-d). In other cases, the contact 110 may beanother computing system. In some cases, the contact 110 may be operatedby a user or group of users. The user or group of users may beassociated with a business, a manufacturer, or any other appropriateorganization.

Cloud platform 115 may offer an on-demand database service to the cloudclient 105. In some cases, cloud platform 115 may be an example of amulti-tenant database system. In this case, cloud platform 115 may servemultiple cloud clients 105 with a single instance of software. However,other types of systems may be implemented, including—but not limitedto—client-server systems, mobile device systems, and mobile networksystems. In some cases, cloud platform 115 may support CRM solutions.This may include support for sales, service, marketing, community,analytics, applications, and the Internet of Things. Cloud platform 115may receive data associated with contact interactions 130 from the cloudclient 105 over network connection 135, and may store and analyze thedata. In some cases, cloud platform 115 may receive data directly froman interaction 130 between a contact 110 and the cloud client 105. Insome cases, the cloud client 105 may develop applications to run oncloud platform 115. Cloud platform 115 may be implemented using remoteservers. In some cases, the remote servers may be located at one or moredata centers 120.

Data center 120 may include multiple servers. The multiple servers maybe used for data storage, management, and processing. Data center 120may receive data from cloud platform 115 via connection 140, or directlyfrom the cloud client 105 or an interaction 130 between a contact 110and the cloud client 105. Data center 120 may utilize multipleredundancies for security purposes. In some cases, the data stored atdata center 120 may be backed up by copies of the data at a differentdata center (not pictured).

System 125 may include cloud clients 105, cloud platform 115, and datacenter 120. In some cases, data processing may occur at any of thecomponents of system 125, or at a combination of these components. Insome cases, servers may perform the data processing. The servers may bea cloud client 105 or located at data center 120.

The system 125 may be an example of a distributed system configured toprocess large amounts of data. In accordance with aspects of the presentdisclosure, the system 125 may be configured to wrap data with one ormore headers as the data enters the system 125. For example, an emailfrom a contact 110 may be wrapped with one or more headers. As describedin more detail below, the headers may facilitate diagnostic,performance, and security functions as the data propagates throughoutthe system 125.

FIG. 2 illustrates an example of a system 200 for communication dataprocessing that supports attaching headers to data to augmentfunctionality in distributed systems in accordance with various aspectsof the present disclosure. The system 200 may be an example of adistributed system, and may be an example of aspects of system 125, asdescribed with respect to FIG. 1. The system 200 may include datasources205, webhooks 210, databases 215, and spans 220. The components ofsystem 200 are illustrated and described as an example in accordancewith the present disclosure, and in some cases, the system 200 mayinclude less or additional components than those pictured in FIG. 2. Thesystem 200 may be configured to attach one or more headers to data as itenters the system 200 from a datasource 205 or a database 215. Theheaders may facilitate diagnostic, performance, and/or securityfunctionality for the system 200.

A datasource 205 may be any type of server, system, or network thatstores or generates data. For example, a datasource 205 may be an emailserver or database associated with a contact 110, as described withreference to FIG. 1. A webhook 210 may be a process or componentconfigured to retrieve data (e.g., communication data) from a datasource205 and pass it along to a span 220 for processing. For example, adatasource 205 may be configured to notify a webhook 210 that somethinghas changed at the datasource 205 (e.g., new data was generated), andthe webhook 210 may be configured to retrieve the new data. In somecases, a database 215 is configured to send data to a span 220 either inreal time or in batches.

A span 220 may refer to a particular process or group or processesand/or the machine or group of machines that perform the process. Forexample, span 220-a may perform a first process on some data (e.g.,extract contact information from the data), and span 220-b may perform asecond process on the data (e.g., perform natural language processing onthe data). Each span 220 may include one or more devices (e.g.,computers, servers, databases or any components of system 125 describedwith reference to FIG. 1) configured to cooperatively process datapassing through the span 220. After data is processed by the spans 220,it may be sent to database 215-b for storage or to some other downstreamsystem, process, or component. A transaction may refer to the completecycle of propagating and processing a particular piece of data throughthe system 200.

A piece of data (e.g., a communication) may include a data portion(e.g., the data payload) and a header portion. For example, the data maybe an email generated at datasource 205-a. In this example, the dataportion may include the body of the email, the addresses associated withthe email, and/or metadata associated with the email, and the headerportion may include one or more headers attached to the data portion bythe system 200. In some cases, the webhook 210-a or the span 220-a maywrap the payload with one or more headers (e.g., associate the payloadwith one or more headers). In other cases, some other component ofsystem 200 may wrap the payload with one or more headers. In anotherexample, database 215-a may send data to span 220-a for processing. Inthis case, database 215-a or span 220-a may wrap the data portion withone or more headers. The one or more headers may include a parentservice header, a trace information header (which may include atransaction identifier header, a parent span identifier header, and asampling header), a tags header, and a web token header. The system 200may wrap a data payload with any combination of these headers.

After webhook 210-a retrieves some data from datasource 205-a, the span220-a may receive the data, including the data portion and the headerportion. Span 220-a may unwrap (e.g., process) the headers from thepayload and process the data portion of the data in accordance with theprocess associated with the span 220-a. The headers attached to thepayload may not affect the processing of the data portion (e.g., by notadding processing time to the normal process associated with span220-a). The span 220-a may store information from the headers locally(e.g., in a log), which the system 200 may later use to perform variousdiagnostic processes (e.g., tracing).

The header portion may include identification information to facilitatetracking the payload throughout the system. For example, the headerportion may include a parent service header, which may identify theoriginating service of the payload. Datasource 205-a may be theoriginating service for a particular payload, and datasource 205-b maybe the originating service for a different payload. The parent servicemay also be referred to as the root service for a piece of data. In someexamples, webhook 210-a and webhook 210-b (or some other component ofsystem 200) may attach parent service headers to the data that uniquelyidentify the corresponding parent or root service.

The header portion may also include a transaction identifier header. Thetransaction identifier header may uniquely identify the transactionassociated with a particular data payload. The header portion may alsoinclude a parent span identifier header. The parent span identifierheader may identify the immediately-preceding span 220 that the payloadwas processed by. For example, in system 200, span 220-a would be theparent span for data with respect to span 220-b if data is transmitteddirectly from span 220-a to span 220-b.

The header portion may also include a sampling header. The samplingheader may indicate whether tracing for a particular piece of datashould be performed. The sampling header may include a single bit thatcan be toggled to indicate that tracing is on or off. The system 200 maybe configurable to selectively or randomly toggle tracing for a certainpercentage of data payloads flowing through the system 200. Thecombination of the transaction identifier header, the parent spanidentifier header, and the sampling header may be included in acombination header referred to as a trace information header.

The one or more headers of the trace information header may facilitateperforming a trace process for system 200. In general, a system traceprocess may analyze how long it takes for a data payload to flow throughthe system 200, and how long the data was at each location or processwithin the system 200. A system trace process may also determine a patha data payload takes throughout a transaction (e.g., which spans 220 thedata was processed by and in which order). For example, the payload maybe sent from span 220-a to span 220-b, and then to database 215-b, whichmay be referred to as the path of the payload throughout thetransaction.

Additionally or alternatively, one or more headers in the header portionmay facilitate real-time performance adjustments to the system 200, suchas throttling. For example, datasource 205-b may be transmitting adisproportionate amount of data (e.g., above a predetermined threshold)to span 220-a, which may consume a disproportionate amount of resources(e.g., bandwidth) and degrade system performance (e.g., by slowing downdata flow from datasource 205-a or database 215-a). System 200 may beable to identify that datasource 205-b is causing the issue based atleast on the parent service header. To more efficiently process the datafrom datasource 205-a and database 215-a, span 220-a (or some othercomponent of system 200) may throttle the data originating fromdatasource 205-b. In some cases, throttling may include stopping allpayloads sent from datasource 205-b to span 220-a. In other cases,throttling may include limiting the number of payloads received fromdatasource 205-b at span 220-a for a predetermined amount of time. Thethrottling may result in improved processing efficiency at span 220-aand improved performance of the system 200.

Additionally or alternatively, one or more headers in the header portionmay facilitate security measures for particular data payloads flowingthrough system 200. For example a component of system 200 may attach aweb token header to the header portion of a data payload. The web tokenheader may specify certain security protocols associated with thepayload, which may help ensure the integrity of the data payload as itis processed by system 200.

In one example, datasource 205-a may receive a new email. Datasource205-a may notify webhook 210-a of the email, and the webhook 210-a mayretrieve the new email and transmit it to span 220-a. Span 220-a (orsome other component of system 200 such as webhook 210-a) may attachheaders to the data corresponding to the email. For example, span 220-amay attach a parent service header indicating the data corresponding tothe email originated at datasource 205-a. Span 220-a may also attach atransaction identifier header, uniquely identifying the transactionassociated with the new email entering the system 200.

Span 220-a may process the data corresponding to the email. For example,at span 220-a, a server may perform natural language processing on theemail to identify important events that occurred in the email. Span220-a may then unwrap or otherwise process any headers associated withthe email (e.g., any headers added by a previous component). Forexample, span 220-a may record a parent service identifier header, atransaction identifier header, and/or a timestamp in local memory. Asdiscussed below, this header information along with the timestampinformation may be used to perform diagnostic analysis on the system200. Span 220-a may modify or add a parent span identifier header toidentify span 220-a as the parent span, and may then send the payload tospan 220-b for further processing. Span 220-b may perform furtherprocessing on the data portion of the email, for example identifying aparticular client associated with the email. Span 220-b may then unwrapor otherwise process any headers associated with the email similar tothe header processing that occurred at span 220-a. Span 220-b may thenmodify the parent span identifier header to identify span 220-b as thenew parent span, and may send the payload to database 215-b for storageor further processing.

A system trace process may be performed to track the processing of theemail throughout the system 200. For example, the system trace processmay determine the amount of time that the server takes to process thedata corresponding to the email at span 220-a (e.g., by analyze thetimestamps associated with the processing at span 220-a). The systemtrace process may track the path and travel time of the payload fromspan 220-a to span 220-b (e.g., by analyzing the parent span identifierheaders and timestamps at each span 220-a and span 220-b). The systemtrace process may track the amount of time span 220-b processed thepayload and the path from span 220-b to database 215-b (e.g., byanalyzing the parent span identifier headers and timestamps at each ofspan 220-b and database 215-b).

In some cases, the system 200 may generate a graphical representation ofthe system trace process. For example, the system 200 may generate anddisplay a call graph to the user. The call graph may indicate the pathof the payload from webhook 210-a to span 220-a, to span 220-b, todatabase 215-b. The call graph may also indicate the amount of time thepayload spent at each span 220 for processing. In some cases, the usermay select to throttle payloads from a specific originating service orspan 220 based on the system trace process displayed in the call graph.In other cases, a span 220 may automatically throttle payloads based onprocessing times or bandwidth usage exceeding a predetermined threshold.

FIG. 3 illustrates an example of a transaction 300 that supports addingheaders to a data payload to augment functionality in distributedsystems in accordance with various aspects of the present disclosure.The transaction 300 may include a producer 305 sending data to aconsumer 310 for processing. The consumer 310 may be an example of aspan 220 or any other component or system that receives and processesdata, as described with reference to FIG. 2. The producer 305 may be anexample of a datasource 205, a webhook 210, a database 215, a span 220or any other component or system that generates or transmits data, asdescribed with reference to FIG. 2. In some cases, a producer 305 may beimplemented in a server or a user device or any component of system 125described with reference to FIG. 1.

In a distributed system, a producer 305 may attach one or more headersto the data portion of a piece of data (e.g., payload 345-a) tofacilitate diagnostic, performance, and/or security functionality forthe distributed system. Attaching the one or more headers may also bereferred to as wrapping the data payload with headers. In some cases,payload 345-a may be an example of a communication (e.g., an email).Attaching the one or more headers may be an augmented function of anexisting mechanism for communication. For example, attaching the one ormore headers may be implemented using a modified library of functions ofan Apache Kafka protocol or an http protocol.

The one or more headers may include a parent service identifier header325-a, a trace info header 330-a (which may include a transactionidentifier header, a parent span identifier header, a samplingidentifier header or any combination of these headers), one or moreheader tags 335-a, and a web token header 340-a. The combination of theone or more headers may be referred to as the header portion of aparticular piece of data.

Parent service identifier header 325-a may indicate a service thatproduced payload 345-a. Each originating or root service may berepresented by a globally unique parent service identifier. Thetransaction identifier header may indicate the particular transaction300 that payload 345-a is part of. Each particular transaction 300 mayhave a globally unique transaction identifier. The parent spanidentifier header may indicate the previous span that interacted withthe payload 345-a. Each span may have a unique parent span identifier.The sampling identifier header may indicate whether a tracing process istoggled on or off for that particular payload 345-a. For example, thesampling identifier header may be represented as a Boolean such that onevalue of the Boolean indicates to the consumer 310 to perform tracing,while another value of the Boolean indicates to the consumer 310 not toperform tracing (or storage or processing of headers to facilitatetracing).

In some cases, the producer 305 may attach header tags 335-a to specifyadditional functionality for the consumer 310 to perform on payload345-a. In some cases, there may be a maximum number of header tags 335-athat can be attached to payload 345-a. In other cases, unlimited headertags 335-a may be attached to payload 345-a. A header tag 335-a may bean example of a data string. The header tag 335-a may specify additionalfunctions for the consumer 310 to perform on the header or on payload345-a. For example, the consumer 310 may modify a system trace processof payload 345-a based on the header tags 335-a. In some cases, theconsumer 310 may store a repository of tags, mapping the string to afunction. For example, a header tag 335-a may be an audit tag. The audittag may be attached to a test payload 345 in order to test how thedistributed system is performing. The producer 305 may periodicallycreate a test payload 345 with an audit tag. The consumer 310 may recordthe tracing of the test payload 345, so that a user may observe thebehavior of the distributed system. In some cases, a user may specifyadditional header tags 335-a and corresponding functionality.

In some cases, the producer 305 may attach a web token header 340-a toincrease security of payload 345-a. In some cases, the web token header340-a may be an example of a JavaScript object notation (JSON) web tokenheader. The web token header 340-a may indicate an owner of the data,information associated with the owner, and a data policy of the owner.The consumer 310 may identify functions that may be performed on payload345-a based on the data policy of the owner. The web token header 340-amay include a signature of the owner. If payload 345-a is altered in thetransaction after the signature of the owner, the header may include anindication that payload 345-a contains an unauthorized alteration. Theconsumer 310 may identify the unauthorized alteration, and may determinewhether to process payload 345-a or alert a user.

A consumer 310 may receive payload 345-a from the producer 305, alongwith any attached headers. The consumer 310 may include business logic320 that processes the payload 345-a as normal (e.g., natural languageprocessing on an email). In some cases, business logic 320 may ignorethe one or more headers when performing operations on payload 345-a. Inother cases, business logic 320 may perform operations on payload 345-abased on the one or more headers. Attaching the one or more headers maynot alter the data or processing of the data for payload 345-a.

The consumer 310 may store information from one or more headers withinthread-local data 315 of a span (or some other local storage method,such as a log). For example, the consumer 310 may identify and store anindication of a parent span and an originating service for payload 345-abased on the one or more headers. The consumer 310 may also store one ormore timestamps indicating when the payload 345-a arrived at theconsumer 310 and/or when the payload 345-a left the consumer 310. Theone or more headers and timestamps may facilitate tracking temporal orcausal relationships within a transaction 300 based on a system traceprocess of payload 345-a.

The consumer 310 may perform throttling based on the distributedtracing. For example, the consumer 310 may identify a particular processor span that is using a large amount of time or resources based on theparent span identifier header. The consumer 310 may throttle the datafrom that span to reduce backup or overhead for the system.

FIG. 4 shows a block diagram 400 of a system 405 that supportsaugmenting functionality in distributed systems with payload headers inaccordance with various aspects of the present disclosure. System 405may include input module 410, data header manager 415, and output module420. System 405 may also include a processor. Each of these componentsmay be in communication with one another (e.g., via one or more buses).In some cases, system 405 may be an example of a user terminal, adatabase server, or a system containing multiple computing devices. Dataheader manager 415 may be an example of aspects of the data headermanager 615 described with reference to FIG. 6. Data header manager 415may also include header identification component 425, spanidentification component 430, and tracing component 435.

Data header manager 415 and/or at least some of its varioussub-components may be implemented in hardware, software executed by aprocessor, firmware, or any combination thereof. If implemented insoftware executed by a processor, the functions of the data headermanager 415 and/or at least some of its various sub-components may beexecuted by a general-purpose processor, a digital signal processor(DSP), an application-specific integrated circuit (ASIC), anfield-programmable gate array (FPGA) or other programmable logic device,discrete gate or transistor logic, discrete hardware components, or anycombination thereof designed to perform the functions described in thepresent disclosure. The data header manager 415 and/or at least some ofits various sub-components may be physically located at variouspositions, including being distributed such that portions of functionsare implemented at different physical locations by one or more physicaldevices. In some examples, data header manager 415 and/or at least someof its various sub-components may be a separate and distinct componentin accordance with various aspects of the present disclosure. In otherexamples, data header manager 415 and/or at least some of its varioussub-components may be combined with one or more other hardwarecomponents, including but not limited to an I/O component, atransceiver, a network server, another computing device, one or moreother components described in the present disclosure, or a combinationthereof in accordance with various aspects of the present disclosure.

Header identification component 425 may receive a communication from aparent span, the communication including a data portion and a headerportion, where the header portion includes an identifier of anoriginating service that produced the communication, an identifier of atransaction for the communication, and an identifier of the parent span.In some cases, the header portion further includes a sampling header,where the sampling header indicates whether to perform the system traceprocess. In some cases, the header portion further includes one or moretags. In some cases, the header portion further includes an identifierof an owner of the communication, information corresponding to theowner, a data policy of the communication, or a combination thereof.

Span identification component 430 may identify the parent span and theoriginating service based on the header portion. Tracing component 435may perform a system trace process of the communication throughout thetransaction based on the parent span and the originating service and maydisplay a graphical representation of the set of spans associated withthe communication throughout the transaction. In some cases, theperforming the system trace process includes identifying a set of spansassociated with the communication throughout the transaction. In somecases, the performing the system trace process includes identifying atemporal relationship between the communication and the set of spansassociated with the communication throughout the transaction. In somecases, the performing the system trace process is based on the one ormore tags.

FIG. 5 shows a block diagram 500 of a data header manager 515 thatsupports augmenting functionality in distributed systems with payloadheaders in accordance with various aspects of the present disclosure.The data header manager 515 may be an example of aspects of a dataheader manager 415 or 615 described with reference to FIGS. 4 and 6. Thedata header manager 515 may include header identification component 520,span identification component 525, tracing component 530, throttlingcomponent 535, processing component 540, and user identificationcomponent 545. Each of these modules may communicate, directly orindirectly, with one another (e.g., via one or more buses).

Header identification component 520 may receive a communication from aparent span, the communication including a data portion and a headerportion, where the header portion includes an identifier of anoriginating service that produced the communication, an identifier of atransaction for the communication, and an identifier of the parent span.In some cases, the header portion further includes a sampling header,where the sampling header indicates whether to perform the system traceprocess. In some cases, the header portion further includes one or moretags. In some cases, the header portion further includes an identifierof an owner of the communication, information corresponding to theowner, a data policy of the communication, or a combination thereof.

Span identification component 525 may identify the parent span and theoriginating service based on the header portion. Tracing component 530may perform a system trace process of the communication throughout thetransaction based on the parent span and the originating service anddisplay a graphical representation of the set of spans associated withthe communication throughout the transaction. In some cases, theperforming the system trace process includes identifying a set of spansassociated with the communication throughout the transaction. In somecases, the performing the system trace process includes identifying atemporal relationship between the communication and the set of spansassociated with the communication throughout the transaction. In somecases, the performing the system trace process is based on the one ormore tags.

Throttling component 535 may throttle communications from the parentspan based on the system trace process. Processing component 540 mayperform an additional process based on the one or more tags. Useridentification component 545 may identify a modification to thecommunication by a user other than the owner of the communication andflag the communication with an indication that the modification was by auser other than the owner of the communication.

FIG. 6 shows a diagram of an environment 600 including a system 605 thatsupports augmenting functionality in distributed systems with payloadheaders in accordance with various aspects of the present disclosure.System 605 may be an example of or include the components of system 125as described above, e.g., with reference to FIG. 1. System 605 mayinclude components for bi-directional data communications includingcomponents for transmitting and receiving communications, including dataheader manager 615, processor 620, memory 625, database controller 630,database 635, and I/O controller 640. The functionality of the abovecomponents may be performed at separate servers, user devices, ordatabases in system 605, or may be performed by different components ofone or more same servers, user devices, or databases. These componentsmay be in electronic communication via one or more busses (e.g., bus610).

Processor 620 may include an intelligent hardware device, (e.g., ageneral-purpose processor, a DSP, a central processing unit (CPU), amicrocontroller, an ASIC, an FPGA, a programmable logic device, adiscrete gate or transistor logic component, a discrete hardwarecomponent, or any combination thereof). In some cases, processor 620 maybe configured to operate a memory array using a memory controller. Inother cases, a memory controller may be integrated into processor 620.Processor 620 may be configured to execute computer-readableinstructions stored in a memory to perform various functions (e.g.,functions or tasks supporting augmenting functionality in distributedsystems with payload headers).

Memory 625 may include random access memory (RAM) and read only memory(ROM). The memory 625 may store computer-readable, computer-executablesoftware 630 including instructions that, when executed, cause theprocessor to perform various functions described herein. In some cases,the memory 625 may contain, among other things, a basic input/outputsystem (BIOS) which may control basic hardware and/or software operationsuch as the interaction with peripheral components or devices.

Database controller 630 may manage data storage and processing indatabase 635. In some cases, a user may interact with databasecontroller 630. In other cases, database controller 630 may operateautomatically without user interaction. Database 635 may be an exampleof a single database, a distributed database, multiple distributeddatabases, or an emergency backup database.

I/O controller 640 may manage input and output signals for device 605.I/O controller 640 may also manage peripherals not integrated intodevice 605. In some cases, I/O controller 640 may represent a physicalconnection or port to an external peripheral. In some cases, I/Ocontroller 640 may utilize an operating system such as iOS®, ANDROID®,MS-DOS®, MS-WINDOWS®, OS/2®, UNIX®, LINUX®, or another known operatingsystem. In other cases, I/O controller 640 may represent or interactwith a modem, a keyboard, a mouse, a touchscreen, or a similar device.In some cases, I/O controller 640 may be implemented as part of aprocessor. In some cases, a user may interact with device 605 via I/Ocontroller 640 or via hardware components controlled by I/O controller640.

FIG. 7 shows a flowchart illustrating a method 700 for augmentingfunctionality in distributed systems with payload headers in accordancewith various aspects of the present disclosure. The operations of method700 may be implemented by a data header manager or its components asdescribed herein. For example, the operations of method 700 may beperformed by a data header manager 415, 515, or 615 as described withreference to FIGS. 4 through 6. In some examples, a data header managermay execute a set of codes to control the functional elements of thedevice to perform the functions described below. Additionally oralternatively, the data header manager may perform aspects of thefunctions described below using special-purpose hardware.

At block 705 the data header manager 415, 515, or 615 may receive acommunication from a parent span, the communication comprising a dataportion and a header portion, wherein the header portion comprises anidentifier of an originating service that produced the communication, anidentifier of a transaction for the communication, and an identifier ofthe parent span. The operations of block 705 may be performed accordingto the methods described with reference to FIGS. 1 through 3. In certainexamples, aspects of the operations of block 705 may be performed by aheader identification component as described with reference to FIGS. 4through 6.

At block 710 the data header manager 415, 515, or 615 may identify theparent span and the originating service based at least in part on theheader portion. The operations of block 710 may be performed accordingto the methods described with reference to FIGS. 1 through 3. In certainexamples, aspects of the operations of block 710 may be performed by aspan identification component as described with reference to FIGS. 4through 6.

At block 715 the data header manager 415, 515, or 615 may perform asystem trace process of the communication throughout the transactionbased at least in part on the parent span and the originating service.The operations of block 715 may be performed according to the methodsdescribed with reference to FIGS. 1 through 3. In certain examples,aspects of the operations of block 715 may be performed by a tracingcomponent as described with reference to FIGS. 4 through 6.

FIG. 8 shows a flowchart illustrating a method 800 for augmentingfunctionality in distributed systems with payload headers in accordancewith various aspects of the present disclosure. The operations of method800 may be implemented by a data header manager or its components asdescribed herein. For example, the operations of method 800 may beperformed by a data header manager 415, 515, or 615 as described withreference to FIGS. 4 through 6. In some examples, a data header managermay execute a set of codes to control the functional elements of thedevice to perform the functions described below. Additionally oralternatively, the data header manager may perform aspects of thefunctions described below using special-purpose hardware.

At block 805 the data header manager 415, 515, or 615 may receive acommunication from a parent span, the communication comprising a dataportion and a header portion, wherein the header portion comprises anidentifier of an originating service that produced the communication, anidentifier of a transaction for the communication, and an identifier ofthe parent span. The operations of block 805 may be performed accordingto the methods described with reference to FIGS. 1 through 3. In certainexamples, aspects of the operations of block 805 may be performed by aheader identification component as described with reference to FIGS. 4through 6.

At block 810 the data header manager 415, 515, or 615 may identify theparent span and the originating service based at least in part on theheader portion. The operations of block 810 may be performed accordingto the methods described with reference to FIGS. 1 through 3. In certainexamples, aspects of the operations of block 810 may be performed by aspan identification component as described with reference to FIGS. 4through 6.

At block 815 the data header manager 415, 515, or 615 may perform asystem trace process of the communication throughout the transactionbased at least in part on the parent span and the originating service.The operations of block 815 may be performed according to the methodsdescribed with reference to FIGS. 1 through 3. In certain examples,aspects of the operations of block 815 may be performed by a tracingcomponent as described with reference to FIGS. 4 through 6.

At block 820 the data header manager 415, 515, or 615 may throttlecommunications from the parent span based at least in part on the systemtrace process. The operations of block 820 may be performed according tothe methods described with reference to FIGS. 1 through 3. In certainexamples, aspects of the operations of block 820 may be performed by athrottling component as described with reference to FIGS. 4 through 6.

FIG. 9 shows a flowchart illustrating a method 900 for augmentingfunctionality in distributed systems with payload headers in accordancewith various aspects of the present disclosure. The operations of method900 may be implemented by a data header manager or its components asdescribed herein. For example, the operations of method 900 may beperformed by a data header manager 415, 515, or 615 as described withreference to FIGS. 4 through 6. In some examples, a data header managermay execute a set of codes to control the functional elements of thedevice to perform the functions described below. Additionally oralternatively, the data header manager may perform aspects of thefunctions described below using special-purpose hardware.

At block 905 the data header manager 415, 515, or 615 may receive acommunication from a parent span, the communication comprising a dataportion and a header portion, wherein the header portion comprises anidentifier of an originating service that produced the communication, anidentifier of a transaction for the communication, and an identifier ofthe parent span. The operations of block 905 may be performed accordingto the methods described with reference to FIGS. 1 through 3. In certainexamples, aspects of the operations of block 905 may be performed by aheader identification component as described with reference to FIGS. 4through 6.

At block 910 the data header manager 415, 515, or 615 may identify theparent span and the originating service based at least in part on theheader portion. The operations of block 910 may be performed accordingto the methods described with reference to FIGS. 1 through 3. In certainexamples, aspects of the operations of block 910 may be performed by aspan identification component as described with reference to FIGS. 4through 6.

At block 915 the data header manager 415, 515, or 615 may perform asystem trace process of the communication throughout the transactionbased at least in part on the parent span and the originating service.The operations of block 915 may be performed according to the methodsdescribed with reference to FIGS. 1 through 3. In certain examples,aspects of the operations of block 915 may be performed by a tracingcomponent as described with reference to FIGS. 4 through 6.

At block 920 the data header manager 415, 515, or 615 may identify aplurality of spans associated with the communication throughout thetransaction. For example, the system trace process of the communicationmay include identifying the plurality of spans. The operations of block920 may be performed according to the methods described with referenceto FIGS. 1 through 3. In certain examples, aspects of the operations ofblock 920 may be performed by a tracing component as described withreference to FIGS. 4 through 6.

At block 925 the data header manager 415, 515, or 615 may display agraphical representation of the plurality of spans associated with thecommunication throughout the transaction. The operations of block 925may be performed according to the methods described with reference toFIGS. 1 through 3. In certain examples, aspects of the operations ofblock 925 may be performed by a tracing component as described withreference to FIGS. 4 through 6.

A method of communication data processing is described. The method mayinclude receiving a communication from a parent span, the communicationcomprising a data portion and a header portion, wherein the headerportion comprises an identifier of an originating service that producedthe communication, an identifier of a transaction for the communication,and an identifier of the parent span, identifying the parent span andthe originating service based at least in part on the header portion,and performing a system trace process of the communication throughoutthe transaction based at least in part on the parent span and theoriginating service.

An apparatus for communication data processing is described. Theapparatus may include a processor, memory in electronic communicationwith the processor, and instructions stored in the memory. Theinstructions may be operable to cause the processor to receive acommunication from a parent span, the communication comprising a dataportion and a header portion, wherein the header portion comprises anidentifier of an originating service that produced the communication, anidentifier of a transaction for the communication, and an identifier ofthe parent span, identify the parent span and the originating servicebased at least in part on the header portion, and perform a system traceprocess of the communication throughout the transaction based at leastin part on the parent span and the originating service.

A non-transitory computer readable medium for communication dataprocessing is described. The non-transitory computer-readable medium mayinclude instructions operable to cause a processor to receive acommunication from a parent span, the communication comprising a dataportion and a header portion, wherein the header portion comprises anidentifier of an originating service that produced the communication, anidentifier of a transaction for the communication, and an identifier ofthe parent span, identify the parent span and the originating servicebased at least in part on the header portion, and perform a system traceprocess of the communication throughout the transaction based at leastin part on the parent span and the originating service.

Some examples of the method, apparatus, and non-transitorycomputer-readable medium described above may further include processes,features, means, or instructions for throttling communications from theparent span based at least in part on the system trace process.

In some examples of the method, apparatus, and non-transitorycomputer-readable medium described above, performing the system traceprocess comprises identifying a plurality of spans associated with thecommunication throughout the transaction.

Some examples of the method, apparatus, and non-transitorycomputer-readable medium described above may further include processes,features, means, or instructions for displaying a graphicalrepresentation of the plurality of spans associated with thecommunication throughout the transaction.

In some examples of the method, apparatus, and non-transitorycomputer-readable medium described above, performing the system traceprocess comprises identifying a temporal relationship between thecommunication and the plurality of spans associated with thecommunication throughout the transaction.

In some examples of the method, apparatus, and non-transitorycomputer-readable medium described above, the header portion furthercomprises a sampling header, wherein the sampling header indicateswhether to perform the system trace process.

In some examples of the method, apparatus, and non-transitorycomputer-readable medium described above, the header portion furthercomprises one or more tags.

In some examples of the method, apparatus, and non-transitorycomputer-readable medium described above, performing the system traceprocess may be based at least in part on the one or more tags.

Some examples of the method, apparatus, and non-transitorycomputer-readable medium described above may further include processes,features, means, or instructions for performing an additional processbased at least in part on the one or more tags.

In some examples of the method, apparatus, and non-transitorycomputer-readable medium described above, the header portion furthercomprises an identifier of an owner of the communication, informationcorresponding to the owner, a data policy of the communication, or acombination thereof.

Some examples of the method, apparatus, and non-transitorycomputer-readable medium described above may further include processes,features, means, or instructions for identifying a modification to thecommunication by a user other than the owner of the communication. Someexamples of the method, apparatus, and non-transitory computer-readablemedium described above may further include processes, features, means,or instructions for flagging the communication with an indication thatthe modification was by a user other than the owner of thecommunication.

It should be noted that the methods described above describe possibleimplementations, and that the operations and the steps may be rearrangedor otherwise modified and that other implementations are possible.Furthermore, aspects from two or more of the methods may be combined.

The description set forth herein, in connection with the appendeddrawings, describes example configurations and does not represent allthe examples that may be implemented or that are within the scope of theclaims. The term “exemplary” used herein means “serving as an example,instance, or illustration,” and not “preferred” or “advantageous overother examples.” The detailed description includes specific details forthe purpose of providing an understanding of the described techniques.These techniques, however, may be practiced without these specificdetails. In some instances, well-known structures and devices are shownin block diagram form in order to avoid obscuring the concepts of thedescribed examples.

In the appended figures, similar components or features may have thesame reference label. Further, various components of the same type maybe distinguished by following the reference label by a dash and a secondlabel that distinguishes among the similar components. If just the firstreference label is used in the specification, the description isapplicable to any one of the similar components having the same firstreference label irrespective of the second reference label.

Information and signals described herein may be represented using any ofa variety of different technologies and techniques. For example, data,instructions, commands, information, signals, bits, symbols, and chipsthat may be referenced throughout the above description may berepresented by voltages, currents, electromagnetic waves, magneticfields or particles, optical fields or particles, or any combinationthereof.

The various illustrative blocks and modules described in connection withthe disclosure herein may be implemented or performed with ageneral-purpose processor, a DSP, an ASIC, an FPGA or other programmablelogic device, discrete gate or transistor logic, discrete hardwarecomponents, or any combination thereof designed to perform the functionsdescribed herein. A general-purpose processor may be a microprocessor,but in the alternative, the processor may be any conventional processor,controller, microcontroller, or state machine. A processor may also beimplemented as a combination of computing devices (e.g., a combinationof a digital signal processor (DSP) and a microprocessor, multiplemicroprocessors, one or more microprocessors in conjunction with a DSPcore, or any other such configuration).

The functions described herein may be implemented in hardware, softwareexecuted by a processor, firmware, or any combination thereof. Ifimplemented in software executed by a processor, the functions may bestored on or transmitted over as one or more instructions or code on acomputer-readable medium. Other examples and implementations are withinthe scope of the disclosure and appended claims. For example, due to thenature of software, functions described above can be implemented usingsoftware executed by a processor, hardware, firmware, hardwiring, orcombinations of any of these. Features implementing functions may alsobe physically located at various positions, including being distributedsuch that portions of functions are implemented at different physicallocations. Also, as used herein, including in the claims, “or” as usedin a list of items (for example, a list of items prefaced by a phrasesuch as “at least one of” or “one or more of”) indicates an inclusivelist such that, for example, a list of at least one of A, B, or C meansA or B or C or AB or AC or BC or ABC (i.e., A and B and C). Also, asused herein, the phrase “based on” shall not be construed as a referenceto a closed set of conditions. For example, an exemplary step that isdescribed as “based on condition A” may be based on both a condition Aand a condition B without departing from the scope of the presentdisclosure. In other words, as used herein, the phrase “based on” shallbe construed in the same manner as the phrase “based at least in parton.”

Computer-readable media includes both non-transitory computer storagemedia and communication media including any medium that facilitatestransfer of a computer program from one place to another. Anon-transitory storage medium may be any available medium that can beaccessed by a general purpose or special purpose computer. By way ofexample, and not limitation, non-transitory computer-readable media cancomprise RAM, ROM, electrically erasable programmable read only memory(EEPROM), compact disk (CD) ROM or other optical disk storage, magneticdisk storage or other magnetic storage devices, or any othernon-transitory medium that can be used to carry or store desired programcode means in the form of instructions or data structures and that canbe accessed by a general-purpose or special-purpose computer, or ageneral-purpose or special-purpose processor. Also, any connection isproperly termed a computer-readable medium. For example, if the softwareis transmitted from a website, server, or other remote source using acoaxial cable, fiber optic cable, twisted pair, digital subscriber line(DSL), or wireless technologies such as infrared, radio, and microwave,then the coaxial cable, fiber optic cable, twisted pair, digitalsubscriber line (DSL), or wireless technologies such as infrared, radio,and microwave are included in the definition of medium. Disk and disc,as used herein, include CD, laser disc, optical disc, digital versatiledisc (DVD), floppy disk and Blu-ray disc where disks usually reproducedata magnetically, while discs reproduce data optically with lasers.Combinations of the above are also included within the scope ofcomputer-readable media.

The description herein is provided to enable a person skilled in the artto make or use the disclosure. Various modifications to the disclosurewill be readily apparent to those skilled in the art, and the genericprinciples defined herein may be applied to other variations withoutdeparting from the scope of the disclosure. Thus, the disclosure is notlimited to the examples and designs described herein, but is to beaccorded the broadest scope consistent with the principles and novelfeatures disclosed herein.

What is claimed is:
 1. A method for data tracing through a distributedsystem, comprising: receiving, at the distributed system and from a datasource, a data payload; automatically generating header information forthe data payload, the header information comprising a transactionidentifier indicating a transaction, a parent service identifierindicating the data source, a parent span identifier indicating a spanof the distributed system, and a JavaScript object notation (JSON) webtoken indicating an owner of the data payload; identifying a set offunctions that is permitted to be performed on the data payload based atleast in part on a data policy of the owner of the data payloadindicated by the JSON web token; wrapping the data payload with theheader information, wherein the data payload is unmodified by thewrapping; performing the transaction on the data payload, wherein thetransaction comprises a plurality of processes performed on the datapayload at a plurality of spans of the distributed system; refrainingfrom performing at least one function associated with the transaction onthe data payload based at least in part on the at least one functionbeing distinct from the set of functions that is permitted to beperformed; and performing a system trace process on the data payloadthrough the transaction using the header information.
 2. The method ofclaim 1, wherein performing the system trace process on the data payloadthrough the transaction comprises: receiving the data payload at a firstspan of the plurality of spans; unwrapping, at the first span, theheader information from the data payload; storing tracing informationfor the transaction based at least in part on the header information;updating the parent span identifier of the header information toindicate the first span; re-wrapping the data payload with the headerinformation, wherein the data payload is unmodified by the re-wrapping;and transmitting the data payload from the first span to a second spanof the plurality of spans.
 3. The method of claim 2, wherein the tracinginformation comprises a path of the data payload through the distributedsystem, a first timestamp associated with receiving the data payload atthe first span, a second timestamp associated with transmitting the datapayload to the second span, a processing time associated with performinga first process of the transaction at the first span, or a combinationthereof.
 4. The method of claim 2, wherein: the tracing informationcomprises first tracing information specific to the first span; and thefirst tracing information is stored locally at the first span asthread-local data, a tracing log, or a combination thereof.
 5. Themethod of claim 1, wherein: the header information further comprises abit indicating whether to trace the data payload; and the system traceprocess is performed on the data payload based at least in part on thebit.
 6. The method of claim 5, further comprising: toggling the bit forthe data payload based at least in part on a periodicity for tracingdata payloads, a trigger event for tracing the data payload, or acombination thereof.
 7. The method of claim 1, wherein the headerinformation further comprises a signature of the owner, the methodfurther comprising: determining that the data payload has been modifiedwhile the header information comprises the signature of the owner; andadding, to the header information, an indication of an unauthorizedalteration of the data payload.
 8. The method of claim 7, furthercomprising: refraining from performing at least one function associatedwith the transaction on the data payload based at least in part on theunauthorized alteration of the data payload.
 9. The method of claim 7,further comprising: transmitting, for display at a user device, an alertmessage indicating the unauthorized alteration of the data payload. 10.The method of claim 1, further comprising: creating a test data payloadfor tracing an additional transaction; automatically generatingadditional header information for the test data payload, the additionalheader information comprising at least an additional transactionidentifier indicating the additional transaction and an audit tagindicating that the test data payload is associated with an additionalsystem trace process; wrapping the test data payload with the additionalheader information; performing the additional transaction on the testdata payload; and performing the additional system trace process on thetest data payload through the additional transaction using theadditional header information.
 11. The method of claim 10, wherein thetest data payload is created according to a periodicity for testing aperformance of the distributed system.
 12. The method of claim 1,further comprising: identifying a first span of the plurality of spansusing an amount of resources satisfying a resource threshold, an amountof processing time satisfying a time threshold, or a combination thereofbased at least in part on the parent span identifier; and throttlingdata from the first span based at least in part on the amount ofresources satisfying the resource threshold, the amount of processingtime satisfying the time threshold, or a combination thereof.
 13. Themethod of claim 1, further comprising: identifying that the data sourceuses an amount of resources satisfying a resource threshold, an amountof processing time satisfying a time threshold, or a combination thereofbased at least in part on the parent service identifier; and throttlingdata from the data source based at least in part on the amount ofresources satisfying the resource threshold, the amount of processingtime satisfying the time threshold, or a combination thereof.
 14. Themethod of claim 1, wherein the data payload is received from the datasource via a webhook.
 15. The method of claim 1, wherein: each span ofthe plurality of spans corresponds to a process or a group of processesof the plurality of processes; and each span of the plurality of spanscomprises a computer, a server, a database, or a combination thereof.16. An apparatus for data tracing through a distributed system,comprising: a processor; memory coupled with the processor; andinstructions stored in the memory and executable by the processor tocause the apparatus to: receive, at the distributed system and from adata source, a data payload; automatically generate header informationfor the data payload, the header information comprising a transactionidentifier indicating a transaction, a parent service identifierindicating the data source, a parent span identifier indicating a spanof the distributed system, and a JavaScript object notation (JSON) webtoken indicating an owner of the data payload; identify a set offunctions that is permitted to be performed on the data payload based atleast in part on a data policy of the owner of the data payloadindicated by the JSON web token; wrap the data payload with the headerinformation, wherein the data payload is unmodified by the wrapping;perform the transaction on the data payload, wherein the transactioncomprises a plurality of processes performed on the data payload at aplurality of spans of the distributed system; refrain from performing atleast one function associated with the transaction on the data payloadbased at least in part on the at least one function being distinct fromthe set of functions that is permitted to be performed; and perform asystem trace process on the data payload through the transaction usingthe header information.
 17. The apparatus of claim 16, wherein theinstructions to perform the system trace process on the data payloadthrough the transaction are executable by the processor to cause theapparatus to: receive the data payload at a first span of the pluralityof spans; unwrap, at the first span, the header information from thedata payload; store tracing information for the transaction based atleast in part on the header information; update the parent spanidentifier of the header information to indicate the first span; re-wrapthe data payload with the header information, wherein the data payloadis unmodified by the re-wrapping; and transmit the data payload from thefirst span to a second span of the plurality of spans.
 18. Anon-transitory computer-readable medium storing code for data tracingthrough a distributed system, the code comprising instructionsexecutable by a processor to: receive, at the distributed system andfrom a data source, a data payload; automatically generate headerinformation for the data payload, the header information comprising atransaction identifier indicating a transaction, a parent serviceidentifier indicating the data source, a parent span identifierindicating a span of the distributed system, and a JavaScript objectnotation (JSON) web token indicating an owner of the data payload;identify a set of functions that is permitted to be performed on thedata payload based at least in part on a data policy of the owner of thedata payload indicated by the JSON web token; wrap the data payload withthe header information, wherein the data payload is unmodified by thewrapping; perform the transaction on the data payload, wherein thetransaction comprises a plurality of processes performed on the datapayload at a plurality of spans of the distributed system; refrain fromperforming at least one function associated with the transaction on thedata payload based at least in part on the at least one function beingdistinct from the set of functions that is permitted to be performed;and perform a system trace process on the data payload through thetransaction using the header information.